Kids can bypass some age checks with a drawn-on mustache • Hacker News Board

Re: Kids can bypass some age checks with a drawn-on mustache

#181

Post by palata » Wed, May 06, 2026, 9:56 AM UTC

EmbarrassedHelp wrote: post #176

data-ottawa wrote: post #109

Earlier quoted context omitted.

I'm writing my (Canadian) MP to this effect. There are a lot of issues with the UK approach. Privacy is a big one. But requiring this on every service is both a tax on the service and requires constantly authorizing stuff. That opens up the possibility for scams, data misuse, etc. And no, saying we said to only use the data for verification clearly doesn't work. It didn't work for discord, or Persona, or Tea or AU10T…

There is no such thing as privacy protecting or anonymous age verification. If you tell Canadian that such a thing is possible, they are guaranteed to harm privacy with any legislation they proposal. Just tell them no.

> There is no such thing as privacy protecting or anonymous age verification

There most definitely is privacy-protecting age verification. You go to a government office, you show your ID, they give you a piece of paper that officially says "over 18 years old". Now you have a piece of paper that says you're over 18 but doesn't say who you are, and the government won't know where you use it.

On the Internet, the idea is the same, but with cryptography.

Re: Kids can bypass some age checks with a drawn-on mustache

#182

Post by palata » Wed, May 06, 2026, 10:01 AM UTC

Tangurena2 wrote: post #112

palata wrote: post #102

Reading the comments here, I see a lot of criticism along the line of "age verification doesn't work, it's completely stupid". I believe it is counter-productive, because "not having age verification" is a lost battle. Unlike E2EE (where it is impossible to give access "only to the good guys"), it is possible to implement age verification in a privacy-preserving manner. And look at the ChatControl fight: even though…

That won't happen. Because the intent of the people pushing for "age verification" has nothing to do with the "think about the children" moral panic. It has to do with eliminating encryption and eliminating online anonymity. It is a dog whistle. https://en.wikipedia.org/wiki/Dog_whistle_(politics)# https://rationalwiki.org/wiki/Code_word https://en.wikipedia.org/wiki/Moral_panic

I disagree. Maybe that's the intent of some people.

Now go in the street and ask random people: "if there was a safe way to protect your children from accessing XYZ on the internet, do you think it would be a good thing?".

Clearly one very real problem for parents right now is that if all the other kids do it, then it's hard to prevent your kid from doing it ("everybody is on TikTok, they make fun of me because I have no clue what's happening there"). If you can prevent most of them from accessing the service, then suddenly it becomes normal for kids not to use it.

Re: Kids can bypass some age checks with a drawn-on mustache

#183

Post by gloosx » Wed, May 06, 2026, 2:50 PM UTC

aussieguy1234 wrote: post #172

gloosx wrote: post #127

When I was a kid, I went as far as to install a key-logger on the computer to get the master password from the parental controls, silently disabling them when I wanted and enabling them again when I'm done so parents would never notice. It's almost sad this AI age verification bs doesn't even pose too big of a challenge for kid's creativity

Sounds like you were more sophisticated as a kid than your adult parents

Most kids are more sophisticated than their parents, who are usually too tired by the burdens of life to notice

Re: Kids can bypass some age checks with a drawn-on mustache

#184

Post by MyHonestOpinon » Wed, May 06, 2026, 3:46 PM UTC

glenngillen wrote: post #94

Morromist wrote: post #20

The next age verification tech will involve checking tallness so we'll have kids standing on eachother's shoulders in a big trenchcoat to do the very adult act of installing linux.

My 12yo son is already significantly taller than me! We had to use his passport to prove he’s much younger than these systems report because they were locking him out from chatting to his friends (said the age gap was too big)

How do they know how tall he was ? Oh perhaps his face looks older too ?

Re: Kids can bypass some age checks with a drawn-on mustache

#185

Post by cortesoft » Wed, May 06, 2026, 3:52 PM UTC

OkayPhysicist wrote: post #173

aussieguy1234 wrote: post #172

Earlier quoted context omitted.

Sounds like you were more sophisticated as a kid than your adult parents

Kids are highly motivated, and have a lot of free time. They make truly obnoxious adversaries.

A true Advance Persistent Threat, although not always that advanced, but definitely persistent.

Re: Kids can bypass some age checks with a drawn-on mustache

#186

Post by kjkjadksj » Wed, May 06, 2026, 4:01 PM UTC

delfinom wrote: post #115

zeec123 wrote: post #25

The result will be age verification with a passport or ID "to protect the children". Probably this was the goal all along.

Politicians worldwide are salivating at the chance of throwing their opposition and critics in prison.

As if that took the internet to do

Re: Kids can bypass some age checks with a drawn-on mustache

#187

Post by hellojesus » Wed, May 06, 2026, 6:48 PM UTC

palata wrote: post #180

hellojesus wrote: post #162

Earlier quoted context omitted.

To date I haven't seen an implementation that preserves privacy and doesn't allow for easy bypass because person A generated infinite tokens and hands them out via a rest request.

I have seen implementations that preserve privacy. But fundamentally it means that an adult could give a token to a kid, as you say. But how bad is that? We don't need a perfect system, we just need it to be good enough that it prevents most kids from accessing stuff they shouldn't access. Some kids will always find a way anyway. A simple solution to "generate infinite token and hands them out via a rest request" cou…

But you can't preserve privacy while rate-limiting token generation unless you have a way of identifying someone, which could be as simple as requiring an account.

And even if it's illegal to hand them out, it's not hard to set up a tor site to do it. I would be first in line to counter the state with such an implementation of this is the path we tread.

Re: Kids can bypass some age checks with a drawn-on mustache

#188

Post by data-ottawa » Wed, May 06, 2026, 10:39 PM UTC

EmbarrassedHelp wrote: post #176

data-ottawa wrote: post #109

Earlier quoted context omitted.

I'm writing my (Canadian) MP to this effect. There are a lot of issues with the UK approach. Privacy is a big one. But requiring this on every service is both a tax on the service and requires constantly authorizing stuff. That opens up the possibility for scams, data misuse, etc. And no, saying we said to only use the data for verification clearly doesn't work. It didn't work for discord, or Persona, or Tea or AU10T…

There is no such thing as privacy protecting or anonymous age verification. If you tell Canadian that such a thing is possible, they are guaranteed to harm privacy with any legislation they proposal. Just tell them no.

There is, a dumb header flag sent by the browser that attests to the user being in an age group.

Fakeable? Sure. Fakeable by an average 13-16 year old on a parental locked device? No.

Re: Kids can bypass some age checks with a drawn-on mustache

#189

Post by palata » Wed, May 06, 2026, 11:12 PM UTC

hellojesus wrote: post #187

palata wrote: post #180

Earlier quoted context omitted.

I have seen implementations that preserve privacy. But fundamentally it means that an adult could give a token to a kid, as you say. But how bad is that? We don't need a perfect system, we just need it to be good enough that it prevents most kids from accessing stuff they shouldn't access. Some kids will always find a way anyway. A simple solution to "generate infinite token and hands them out via a rest request" cou…

But you can't preserve privacy while rate-limiting token generation unless you have a way of identifying someone, which could be as simple as requiring an account. And even if it's illegal to hand them out, it's not hard to set up a tor site to do it. I would be first in line to counter the state with such an implementation of this is the path we tread.

I think you misunderstand what "privacy-preserving" means here. The whole point is that they CAN identify you (to verify your age), but in... well a privacy-preserving manner :-).

That is, one side knows who you are, but not what you do; the other side knows what you do, not who you are.

> And even if it's illegal to hand them out, it's not hard to set up a tor site to do it.

If a kid can use Tor to get a token, they most certainly can download with torrent or use a VPN to bypass the verification. But again, it doesn't have to be perfect, it just has to be effective for enough kids.

> I would be first in line to counter the state with such an implementation of this is the path we tread.

In a functioning democracy, people should vote instead of vandalising stuff. In a non-functional democracy, I guess don't complain if someone burns your car "to counter the state" some day if you think like this.

My point is that we should fight for privacy-preserving solutions. And the first step is to get informed about whether or not it is possible to verify the age in a privacy-preserving manner. Not to prepare for vandalism.

Re: Kids can bypass some age checks with a drawn-on mustache

#190

Post by palata » Wed, May 06, 2026, 11:15 PM UTC

data-ottawa wrote: post #188

EmbarrassedHelp wrote: post #176

Earlier quoted context omitted.

There is no such thing as privacy protecting or anonymous age verification. If you tell Canadian that such a thing is possible, they are guaranteed to harm privacy with any legislation they proposal. Just tell them no.

There is, a dumb header flag sent by the browser that attests to the user being in an age group. Fakeable? Sure. Fakeable by an average 13-16 year old on a parental locked device? No.

By privacy-preserving, we usually mean that you get some kind of cryptographic token from an entity that knows who you are (and can attest that you are above age), and that token is anonymous, so when you use it to access a random service, that service cannot extract information about you from the token, except that you are above age.

It is possible, it just had to be implemented properly. We could complain about politicians not understanding that, of course. But if you spend 5 minutes reading complaints about age verification, you will see that nobody cares about understanding... if the people doesn't care, why would the politicians?